ControlsMonitoring
Continuously verifying that the controls a framework requires are actually still in place — not just documented once and forgotten.
Why we need this / what value this brings
A control that's documented but not actually checked regularly tends to silently stop being true.
When to use this
Once you have controls written down (via PolicyManagement) that need ongoing verification, not just a one-time setup.
How to use or implement this
Automate evidence collection where possible (e.g. a script confirming access logs are enabled) rather than relying on manual periodic checks.
Research questions
- What would 'evidence' even look like for a control like 'all production access is logged' — is that already true today?
Empty folder — drop notes, links, and findings here as you research.